# Pentesting iOS Apps

Aikido Pentest assesses native and hybrid iOS apps on a **Mobile Application** assessment. Testing is whitebox, so connect the repository that contains the iOS app source code.

## Test one app or both

On the **Scope** step, upload the mobile apps this assessment should cover and add the web app or API they call.

| What you include | What Aikido tests |
| --- | --- |
| IPA and the web URL | The iOS app and that web app or API |
| APK and the web URL | The Android app and that web app or API. See [Pentesting Android Apps](https://help.aikido.dev/pentests/configure-a-pentest/android-pentesting). |
| APK, IPA, and the web URL | Both apps and the shared web app or API |

Add the web URL when the app has a backend. Upload both apps when you have Android and iOS, so one assessment tests that shared web app or API once and covers both clients. Separate assessments repeat that work.

A website or API with no mobile app is a **Web Application** assessment. See [How to Setup a Pentest](https://help.aikido.dev/pentests/configure-a-pentest/starting-an-assessment).

{% hint style="warning" %}
Run the assessment against a test environment that closely mirrors production. Don't use production data or accounts.
{% endhint %}

## Prerequisites

* **Manage Pentests** [permission](https://help.aikido.dev/getting-started/automated-user-management/setting-roles-and-permissions)
* **Sufficient credits** in your [wallet](https://help.aikido.dev/miscellaneous-info/wallet-and-credits)
* **Your iOS app source code** in a repository you can connect to Aikido
* **A signed, unencrypted IPA** (500 MB max) with no certificate pinning, jailbreak detection, or emulator checks

## Prepare the IPA

Aikido installs the IPA you upload. App Store and TestFlight builds are FairPlay-encrypted, so Aikido can't install them. Export a **Development**, **Ad Hoc**, or **Enterprise** IPA from Xcode. That file is signed and not encrypted.

In that test build:

* Turn off certificate pinning.
* Turn off jailbreak detection and emulator checks.

1. In Xcode, choose **Product** → **Archive**.
2. In the Organizer, click **Distribute App**.
3. Select **Development**, **Ad Hoc**, or **Enterprise**.
4. Export the `.ipa`.

Hybrid apps (for example React Native or Flutter) use the same export. The file must be an `.ipa`, not an `.app` or an `.xcarchive`.

## Create an iOS assessment

{% stepper %}
{% step %}
### Select Mobile Application

Go to **Pentests**, open your **Project**, and click **Create Assessment**. On the **Select Pentest Target** step, select **Mobile Application**.
{% endstep %}

{% step %}
### Define test scope

On the **Scope** step, add the web app or API URL (for example, `https://api.application.com`) so Aikido can test those endpoints.

Under **iOS Application**, upload the IPA (500 MB max). Aikido reads the bundle ID from the file. The IPA must be unencrypted, and it must not use certificate pinning, jailbreak detection, or emulator checks.

Upload the IPA on its own for an iOS-only run. Upload the APK on this step as well when the assessment should cover both apps. See [Pentesting Android Apps](https://help.aikido.dev/pentests/configure-a-pentest/android-pentesting).

Choose **Test entire application** or **Test specific parts only**.
{% endstep %}

{% step %}
### Add test users

Add a test user for each role you want Aikido to test, such as an admin, a standard user, or a user from another tenant.

If the assessment includes both apps, set **Platform** to **iOS** for the iOS user. For username and password authentication, Aikido uses the bundle ID instead of a login URL.

You can run the login preflight check before you launch. See [Setting Up Test Users](https://help.aikido.dev/pentests/configure-a-pentest/setting-up-authenticated-testing).
{% endstep %}

{% step %}
### Configure access, context, and safety

Configure the remaining steps in the wizard:

* **Allowed Domains:** Allow domains that the app needs to reach during testing.
* **Code & Documentation:** Connect the repository that contains the iOS app source code. Aikido only supports whitebox testing for mobile apps, so the assessment needs that repository. You can also link backend repositories and add documentation. See [Leveraging Code and Documentation](https://help.aikido.dev/pentests/configure-a-pentest/leveraging-code-and-documentation).
* **Safety Check:** Set the request rate and permitted testing hours. See [Safety Measures](https://help.aikido.dev/pentests/configure-a-pentest/safety-measures).
* **Pricing:** Select the assessment profile and review the credit cost. See [Pentest Pricing](https://help.aikido.dev/pentests/pentest-pricing).
{% endstep %}

{% step %}
### Review and launch

On the **Summary** step, confirm the **iOS App** bundle ID and the rest of the configuration, then click **Run Assessment**.
{% endstep %}
{% endstepper %}

## Review results

Open the assessment to follow progress and review its **Issues** tab. iOS findings can cover sensitive data handling, network security, URL schemes and universal links, WebView security, client-side authentication, cryptography, privacy, and release configuration.

When the assessment is complete, download a PDF from the assessment. See [Pentest Reports](https://help.aikido.dev/pentests/coverage-and-findings/pentest-reports).

Replacing the IPA on an existing assessment is coming soon. See [Retest Pentest Findings](https://help.aikido.dev/pentests/coverage-and-findings/retest-pentest-findings).

## Related

{% content-ref url="android-pentesting.md" %}
[Pentesting Android Apps](https://help.aikido.dev/pentests/configure-a-pentest/android-pentesting)
{% endcontent-ref %}

{% content-ref url="setting-up-authenticated-testing/" %}
[Setting Up Test Users](https://help.aikido.dev/pentests/configure-a-pentest/setting-up-authenticated-testing)
{% endcontent-ref %}

{% content-ref url="leveraging-code-and-documentation.md" %}
[Leveraging Code and Documentation](https://help.aikido.dev/pentests/configure-a-pentest/leveraging-code-and-documentation)
{% endcontent-ref %}